Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/01/2025, 21:32
250109-1dpr9a1rc1 1004/12/2024, 03:12
241204-dqgwvaypcy 1003/12/2024, 21:44
241203-1lvy8swjgv 1025/09/2024, 06:02
240925-grgh9asblg 10Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll
-
Size
422KB
-
MD5
f55920966b4970588ce643af0fcc03a7
-
SHA1
97c44c58f24358442cb1811a7694e5b395e82d61
-
SHA256
0d533321292f6854d7f9705a738d58ee5941c93b52674681083ec5c21a987ab1
-
SHA512
b5e6f91e65eacd6c1ad5f563f0d9184fd21fb88848008c7ea568d7c40c63fcbf217eeee2830a521313a3152e538821a469630fe951e760405972afae8516023e
-
SSDEEP
12288:yClc4hq+Ytl63+YzGKBTpJHtvgqYe7S9S:Tlc4kBl6OabpFtGgS0
Malware Config
Extracted
zloader
-
build_id
49
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dyac = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Caycu\\ebcofuf.dll,DllRegisterServer" msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 4 3052 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2156 set thread context of 3052 2156 rundll32.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 3052 msiexec.exe Token: SeSecurityPrivilege 3052 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2448 wrote to memory of 2156 2448 rundll32.exe 30 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31 PID 2156 wrote to memory of 3052 2156 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f55920966b4970588ce643af0fcc03a7_JaffaCakes118.dll,#12⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-